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Why GAO Did This Study 

The Department of Homeland 
Security's (DHS) Atlas program is 
intended to modernize Immigration 
and Customs Enforcement's (ICE) 
information technology (IT) 
infrastructure. By congressional 
mandate, DHS is to develop and 
submit for approval an expenditure 
plan for Atlas that satisfies certain 
legislative conditions, including a 
review by GAO. GAO was asked to 
determine whether the plan 
satisfied certain legislative 
conditions and to provide 
observations on the plan and 
management of the program. 



What GAO Recommends 



To strengthen Atlas planning and 
management, GAO recommends 
that the Secretary of DHS ensure 
that ICE follows through on 
commitments to implement 
effective management controls and 
capabilities by, among other things, 
revising and updating the cost- 
benefit analysis; making the 
program office operational; 
developing and implementing 
rigorous performance program 
management practices; and 
ensuring that future expenditure 
plans fully disclose the system 
capabilities, schedule, cost, and 
benefits to be delivered. In its 
written comments on this report, 
DHS concurred with GAO's 
recommendations and 
stated actions that it was taking to 
implement them. 



www.gao.gov/cgi-bin/getrpt7GAO-05-805. 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact Randy Hite, 
(202) 512-3439, HiteR@gao.gov. 



What GAO Found 

DHS's fiscal year 2004 Atlas expenditure plan, related documentation, and 
program officials' statements satisfied all conditions imposed by Congress, 
including (1) meeting the capital planning and investment control review 
requirements established by the Office of Management and Budget (OMB); 
(2) complying with the DHS enterprise architecture; (3) complying with the 
acquisition rules, requirements, guidelines, and systems acquisition 
management practices of the federal government; and (4) being reviewed 
and approved by ICE's Investment Review Board, DHS, and OMB. However, 
this satisfaction is based more on plans and commitments that provide for 
meeting these conditions than on completed actions. As such, much remains 
to be accomplished for Atlas planning and management efforts to be 
considered effective and thereby minimize the risks associated with the 
program's capacity to deliver promised IT infrastructure capabilities and 
benefits on time and within budget. 

GAO developed a number of observations about the expenditure plan and 
DHS's management of the program. The observations address the need for 
economic justification of Atlas, rigorous and disciplined program 
management practices, performance measurements that are linked to goals 
and benefits, and an expenditure plan that provides sufficient information on 
program commitments for it to be a useful accountability tool. For example, 
Atlas's existing economic justification does not reflect recent and planned 
changes in the program's scope and purpose, including plans to expand the 
program beyond IT infrastructure upgrades. In addition, program 
management controls and capabilities have yet to be established. While ICE 
has begun to establish an Atlas program office, this office is not yet 
operational and is not adequately staffed. For example, while ICE has 
assigned a program manager and three contracting staff, it has not yet 
determined how many staff will be needed on the Atlas projects. In addition, 
while the program manager recently assessed staffing needs for program 
support positions, and identified several, none have been filled (see graphic). 
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United States Government Accountability Office 
Washington, D.C. 20548 



September 7, 2005 

The Honorable Judd Gregg 
Chairman 

The Honorable Robert C. Byrd 
Ranking Member 

Subcommittee on Homeland Security 
Committee on Appropriations 
United States Senate 

The Honorable Harold Rogers 
Chairman 

The Honorable Martin Olav Sabo 
Ranking Member 

Subcommittee on Homeland Security 
Committee on Appropriations 
House of Representatives 

The 2004 Department of Homeland Security Appropriations Act 1 provided 
$40 million for Immigration and Customs Enforcement's (ICE) program to 
modernize its information technology (IT) infrastructure. 2 The goals of the 
program — which ICE refers to as "Atlas" — are to, among other things, 
improve information sharing, strengthen information security, and improve 
workforce productivity. The act provided that the Department of Homeland 
Security (DHS) was prohibited from obligating the $40 million until it 
developed a plan for how the funds are to be spent that satisfied certain 
legislative conditions, including having the plan reviewed by us. On March 
16, 2005, DHS submitted its fiscal year 2004 expenditure plan to the Senate 
and House Appropriations Subcommittees on Homeland Security. Pursuant 
to the act, we reviewed the plan; our objectives were to (1) determine 
whether the plan satisfies legislative conditions specified in the act and (2) 
provide any other observations about the plan and management of the 
program. 

On May 10 and 24, 2005, we briefed the Senate and House Homeland 
Security Subcommittee staffs, respectively, on the results of our review. 



'Pub. L. No. 108-90 (Oct. 1, 2003). 

2 During fiscal year 2004, the Department of Homeland Security reprogrammed about $30.2 
million of the $40 million to address other ICE priorities, thereby leaving $9.8 million for the 
program. 
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This report transmits the results of that work. The full briefing, including 
our scope and methodology, is reprinted in appendix I. 



Compliance with 
Legislative Conditions 



DHS satisfied each of the applicable legislative conditions specified in the 
act. In particular, the plan, including related program documentation and 
program officials' statements, satisfied or provided for satisfying all key 
aspects of (1) meeting the capital planning and investment control review 
requirements of the Office of Management and Budget (OMB); 3 (2) 
complying with the DHS enterprise architecture; 4 (3) complying with 
acquisition rules, requirements, guidelines, and systems acquisition 
management practices of the federal government; and (4) having the plan 
reviewed and approved by ICE's Investment Review Board, DHS, and OMB. 

However, satisfaction of these legislative conditions is based in large part 
on plans and oral commitments by program officials that provide for 
meeting the conditions. To illustrate, OMB capital planning requirements 
direct agencies planning to make a major IT investment, like Atlas, to 
among other things (1) summarize the investment's life-cycle costs; (2) 
analyze costs and benefits, including return on investment; (3) establish 
performance goals and measures; and (4) develop security and privacy 
plans. The Atlas program does not have a current life-cycle cost estimate 
nor a current cost-benefit analysis showing return on investment. It also 
does not have a complete set of performance measures. Further, the 
program does not have an up-to-date security plan that includes Atlas, and 
officials have yet to develop a privacy impact assessment for the program. 
The program manager acknowledged these shortfalls and either planned or 
orally committed to fully satisfy the requirements when expenditure plan 
funds become available. 



3 OMB Circular A-l 1 establishes policy for planning, budgeting, acquiring, and managing 
federal capital assets. Capital investment and control requirements are now found in OMB 
Circular A-ll, part 7, rather than in part 3. 

4 An enterprise architecture provides a clear and comprehensive picture of an organization's 
operations and its supporting systems and infrastructure. It is an essential tool for 
effectively and efficiently engineering business processes and for implementing and 
evolving supporting systems in a manner that maximizes interoperability, minimizes overlap 
and duplication, and optimizes performance. 



Page 2 



GAO-05-805 Information Technology 



Other Observations on 
the Expenditure Plan 
and Management of 
Atlas 



Our observations address the need for economic justification of Atlas, 
rigorous and disciplined program management practices, performance 
measurements that are linked to goals and benefits, and an expenditure 
plan that provides sufficient information on program commitments to 
make the plan a useful accountability tool. An overview of specific 
observations follows: 



• Economic justification (i.e., analysis of costs and benefits) does not 
reflect recent and planned changes in the program's scope and 
purpose. The existing cost-benefit analysis — which was developed in 
2002 — has not yet been revised to reflect changes in the program's scope 
and purpose. Since ICE became responsible for Atlas in 2003 (inherited 
from the Immigration and Naturalization Service) it has materially 
changed the program's scope, purpose, and priorities. Specifically, Atlas 
was expanded to (1) support additional law enforcement units 5 (and 
their business requirements) that were merged into ICE and (2) provide 
the flexibility to support new ICE priorities, such as integrating future 
antiterrorism programs and projects and facilitating information sharing 
with domestic and international law enforcement organizations. In 
addition, the program is also being expanded beyond infrastructure 
upgrades to include efforts to streamline and reengineer core business 
functions with the application of IT. According to the fiscal year 2004 
expenditure plan and program manager, revising the analysis is a "next 
step" to be taken and the goal is to have a contractor complete an 
updated cost-benefit analysis on or about September 30, 2005. 

• Program management controls and capabilities have yet to be 
established. ICE has begun to establish an Atlas program office; 
however, the program office is not yet operational. Specifically, the 
bureau has drafted a management structure and plan, which includes 
staff roles and responsibilities. However, the structure and plan are 
currently being reviewed by ICE management and have not been made 
final. Moreover, of the $63.52 million that ICE reported was obligated for 
Atlas in fiscal years 2002 and 2003, only about $900,000 (or about 1.4 
percent of the total amount) was obligated for program management 
capabilities. In contrast, our work on other IT modernization programs 
(including two in DHS) show that 19 percent was invested in such 



5 The units include the Federal Air Marshals Service, Federal Protective Service, Customs 
investigations, and Customs intelligence. 
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management capabilities. In addition, while key acquisition 
management processes have been defined in ICE's System Development 
Life Cycle methodology, the program office has yet to implement these 
processes. 

Further, the program office is not adequately staffed. 6 Currently, the 
office has staffed the program manager position, and it has three 
contracting staff performing functions such as developing staffing 
needs assessments and other program management-related activities. 
While the program manager recently assessed staffing needs for 
program support positions (e.g., financial management, contracting, and 
enterprise architecture), he has not yet performed a needs assessment 
to determine the staffing needs for the five of the six projects that 
comprise the Atlas program. Moreover, of the seven program support 
positions that the program manager has determined are needed, none 
have been filled, according to program officials. The program manager 
stated that ICE plans to strengthen program management controls and 
capabilities once funds provided for in the expenditure plan are 
available. 

• Program goals, expected benefits, and reported achievements are not 
fully aligned. The Atlas expenditure plan and documentation show that 
the program has defined goals and expected benefits and has reported 
actual achievements accomplished during fiscal years 2002 and 2003. 
However, the relationships among goals, benefits, and achievements 
have not been defined and are not apparent in all cases. Moreover, the 
reported achievements are not expressed in terms of measurable 
outcomes or results, but rather as activities completed. The program 
manager stated that the 2002 and 2003 achievements were not analyzed 
and aligned to program goals and benefits, and that outcome-based 
measures were not developed in part because the emphasis at the time 
was on buying and deploying long overdue infrastructure upgrades as 
quickly as possible. He stated that in the future, the program intends to 
define, ensure, and disclose the linkage among program goals, benefits, 
and results. 



According to the program manager, Atlas staffs were transferred to the US-Visitor and 
Immigrant Status Indicator Technology program in 2003, which is managed by the DHS 
Under Secretary for Border and Transportation Security. 
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• Fiscal year 2004 expenditure plan does not provide sufficient 
information on program commitments to permit effective 
congressional oversight. The Atlas expenditure plan does not show the 
level of detail and scope of the program needed for Congress to 
understand its plans and commitments relative to system capabilities, 
cost, benefits, and schedule. Further, it does not sufficiently describe 
progress made against program commitments (e.g., expected benefits). 
According to the program manager, the state of the plan reflects the 
program's uncertainty about the appropriate level of detail in 
expenditure plans. He stated that future plans will include missing 
content. 



Conclusions ^he f" lsca l y ear 2004 Atlas expenditure plan, in combination with related 

program documentation and program officials' statements, satisfies the 
legislative conditions set forth by Congress. However, this satisfaction is 
based more on plans and commitments that provide for meeting these 
conditions than on completed actions. As such, much remains to be 
accomplished for Atlas planning and management efforts to be considered 
effective and thereby minimize the risks associated with the program's 
capacity to deliver promised IT infrastructure capabilities and benefits on 
time and within budget. 

The current state of planning and management puts the program at risk. 
While this is partially due to events beyond the program's control, such as 
the department's decision to reprogram Atlas funding and to redeploy Atlas 
staff to competing DHS priorities, as well as to change the program's scope 
and purpose when it transitioned from the Immigration and Naturalization 
Service to ICE, it is also due to the program's decision not to use fiscal 
years 2002 and 2003 funds to invest in program management capabilities. 

Given that more than $60 million has reportedly been obligated to date on 
the program, resources have been available to strengthen planning and 
management capabilities in key areas, but investment in these areas has 
been deferred. Deferral of establishing such program planning and 
management controls and capabilities — such as having reliable and current 
economic justification for the program; a capable program office; and 
clearly aligned program goals, benefits, and performance measures — 
introduce unnecessary risk to the program. 

Moreover, not providing congressional decision makers with the 
information that they need about program commitments to be met with the 
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expenditure plan funds — including the benefits to be produced, the 
capabilities to be delivered, and the cost and schedule estimates to be 
met — impedes congressional oversight. 



Recommendations for 
Executive Action 



To minimize risks to the Atlas program, we recommend that the Secretary 
of Homeland Security, through the Under Secretary for Border and 
Transportation Security, direct the Assistant Secretary for Immigration and 
Customs Enforcement to ensure that ICE follows through on commitments 
to implement effective management controls and capabilities by taking the 
following five steps: 

• Revising and updating the cost-benefit analysis, to identify current 
mission requirements; how they will be met; and an estimate of the 
program's incremental and life-cycle costs, benefit, schedule, and return 
on investment. This should also include establishing plans, associated 
tasks, and milestones for accomplishing this effort. 

• Making the Atlas program office operational by (1) developing a staffing 
needs assessment to determine the positions and the level of staffing 
needed for all projects to adequately manage the program, including a 
human capital strategy and timetable for acquiring the staff and bringing 
them on board; (2) finalizing the roles and responsibilities for the 
positions identified in the staffing assessment and for the projects; and 
(3) implementing and institutionalizing key acquisition management 
controls, including risk management processes where relevant 
responsibilities are assigned and key risks and their status are reported 
to an executive body. 

• Developing and implementing an updated Atlas security plan and 
privacy impact assessment. This should also include establishing plans, 
associated tasks, and milestones for accomplishing this effort. 



• Developing and implementing rigorous performance management 
practices for the Atlas program that include properly aligned goals, 
benefits, achievements, and anticipated achievements that are defined 
in measurable terms. This should also include establishing plans, 
associated tasks, and milestones for accomplishing this effort. 

• Ensuring that future expenditure plans fully disclose the system 
capabilities, schedule, cost, and benefits to be delivered, as well as the 
acquisition strategy for Atlas. 
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AgGllCy Comments * n * ne department's written comments on a draft of this report, which were 

contained in a letter signed by the director, DHS Departmental GAO/Office 
of Inspector General Liaison, DHS concurred with all of our 
recommendations and stated actions it was taking to implement them. 
DHS's comments are reprinted in appendix II. 



We are sending copies of this report to the Chairmen and Ranking Members 
of other Senate and House committees and subcommittees that have 
authorization and oversight responsibilities for homeland security. We are 
also sending copies to the Secretary of Homeland Security and the Director 
of OMB. Copies of this report will also be available at no charge on our Web 
site at www.gao.gov. 

Should you or your offices have any questions on matters discussed in this 
report, please contact me at (202) 512-3439 or at hiter@gao.gov. Contact 
points for our Offices of Congressional Relations and Public Affairs may be 
found on the last page of this report. Key contributors to this report are 
listed in appendix III. 




Randolph C. Hite 

Director, Information Technology Architecture 
and Systems Issues 
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Appendix I 

Briefing to the Staffs of the Subcommittees on 
Homeland Security, Senate and House 
Committees on Appropriations 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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Briefing Overview 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



A Q Q Introduction 
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The Department of Homeland Security's (DHS) Bureau of Immigration and 
Customs Enforcement (ICE) 1 is responsible for enforcing border security, trade, 
and other laws by, for example, investigating and collecting intelligence on 
individuals and groups who act to violate these laws. ICE is also responsible for 
detecting and deterring hostile acts on U.S. commercial aviation and protecting 
federal facilities. 

Atlas is an ICE program to modernize the bureau's information technology (IT) 
infrastructure. IT infrastructure includes the hardware (e.g., servers, routers, 
storage devices, communication lines) and system software (e.g., database 
management and operating systems and network management) that provide an 
environment for operating and maintaining software applications. 

According to ICE, the goals of Atlas include improving information sharing, 
strengthening information security, and improving workforce productivity. 



1 ICE was formed from the former Immigration and Naturalization Service, U.S. Customs Service, and other entities. Atlas began in 2002 under 
the former INS. 
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on Homeland Security, Senate and House 
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Introduction 



The fiscal year 2004 Department of Homeland Security Appropriations Act 2 
appropriated $40 million for Atlas and provided that DHS was prohibited from 
obligating these funds until the department submitted a plan for how the funds were 
to be spent that satisfied the following legislative conditions: 

• meets the capital planning and investment control review requirements 
established by the Office of Management and Budget (OMB), including OMB 
Circular A-11, part 3, 3 

• complies with DHS's enterprise architecture, 4 

• complies with the acquisition rules, requirements, guidelines, and systems 
acquisition management practices of the federal government, 



2 Pub.L. No. 108-90 (Oct. 1, 2003). 



3 OMB Circular A-1 1 establishes policy for planning, budgeting, acquisition, and management of federal capital assets. Capital investment and 
control requirements are now found in OMB Circular A-11, part 7, rather than part 3. 

4 As agreed with the staffs of the appropriations subcommittees, we assessed compliance with the DHS enterprise architecture in lieu of the ICE 
enterprise architecture. 
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• is reviewed and approved by ICE's Investment Review Board (IRB), 5 DHS, and 
OMB, and 

• is reviewed by GAO. 

During fiscal year 2004, DHS reprogrammed about $30.2 million of the Atlas funds 
to cover other ICE priorities, leaving $9.8 million for the program. 

DHS submitted its fiscal year 2004 expenditure plan for $9.8 million on March 16, 
2005, to its Senate and House Appropriations Subcommittees on Homeland 
Security. 



5 The purpose of the IRB is to integrate capital planning and investment control, budgeting, and acquisition. It is also to ensure that spending on 
investments directly supports and furthers the mission and that this spending provides optimal benefits and capabilities to stakeholders and 
customers. 



5 
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Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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As agreed, our objectives were to 

1 . determine whether the Atlas fiscal year 2004 expenditure plan satisfies the 
legislative conditions, and 

2. provide any other observations about the expenditure plan and DHS's 
management of the Atlas program. 

We conducted our work at DHS and ICE headquarters in Washington, D.C. from 
March 2005 through May 2005 in accordance with generally accepted government 
auditing standards. Details of our scope and methodology are provided in 
attachment I. 



6 
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Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



AGAO 

Accountability « Integrity * Reliability 


Results in Brief 


Objective 1: Satisfaction of Legislative Conditions 


Legislative conditions 


Status 




1 . Meets the capital planning and investment control review 

requirements established by OMB, including OMB Circular A-1 1 , 
part 7. 6 


Satisfied 7 




2. Complies with the DHS enterprise architecture. 


Satisfied 




3. Complies with the acquisition rules, requirements, guidelines, 
and systems acquisition management practices of the federal 
government. 


Satisfied 




4. Is reviewed and approved by ICE IRB, DHS, and OMB. 


Satisfied 




5. Is reviewed by GAO. 


Satisfied 




6 Capital investment and control requirements are now found in OMB Circular A-1 1 , part 7, rather than part 3. 
'Satisfied: Satisfied or provides for satisfying every aspect of the condition that we reviewed. 


7 



Page 14 



GAO-05-805 Information Technology 



Appendix I 
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Objective 2: Other Observations 

• Economic justification does not reflect recent and planned changes in the 
program's scope and purpose. 

• Program management controls and capabilities have yet to be established. 

• Program goals, expected benefits, and reported achievements are not fully 
aligned. 

• Fiscal year 2004 expenditure plan does not provide sufficient information on 
program commitments to permit effective congressional oversight. 
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Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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Recommendations 

We are making recommendations to the Secretary of DHS to improve Atlas 
expenditure planning and program management. 

In commenting on a draft of this briefing, ICE's chief information officer and the 
Atlas program manager agreed with our findings and conclusions and stated that 
our recommendations were reasonable. 
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on Homeland Security, Senate and House 
Committees on Appropriations 
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ICE was formed as a component agency of DHS in 2003 when the law 
enforcement functions of the Justice Department's former Immigration and 
Naturalization Service (INS) and the Treasury Department's former Customs 
Service, among other agencies, were merged into DHS. 

The ICE mission is to ensure the security of the American people and homeland by 
investigating violators of, and thereby, enforcing the nation's immigration and 
customs laws; protecting U.S. commercial air carriers, airports, passengers, and 
crews; policing and securing federal buildings and other facilities; and collecting, 
analyzing, and disseminating intelligence to assist it in these endeavors. 

Headed by the Assistant Secretary of Immigration and Customs Enforcement, ICE 
has approximately 15,000 employees in over 400 offices domestically and in other 
countries. 

The Atlas program was started by INS in 2002. Responsibility for the program was 
transferred to ICE in 2003 as part of the establishment of DHS. 

The figure on the following page shows ICE and Atlas organizational placement 
within the department. 
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Background 

ICE and Atlas Organizational Placement 



Simplified DHS organizational chart showing ICE and Atlas program 



Department 
of Homeland 
Security Secretary 



Comissioner for 
Customs and 
Border Protection 



Deputy Secretary 




Director, Bureau of 
Citizenship and 
Immigration Services 





Under Secretary 
for Border and 
Transportation Security 



Assistant Secretary 
for Immigration and 
Customs Enforcement 



- Federal Air Marshall Service 

- Federal Protection Service 

- Office of Detention and 
Removal Operations 

- Office of Intelligence 

- Office of Investigations 

- Office of Chief Information 
Officer 



is 



Assistant Secretary 
for Transportation 
Security Administration 



Source: GAO analysis of DHS data. 
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Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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^ ^ ^ Impetus for Atlas 
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According to ICE officials, Atlas was initiated to address information sharing and 
security limitations within the former INS caused by, for example, 

• obsolete hardware/software that needed refreshing; 

• incompatible, non-interoperable information systems; and 

• uneven system security capabilities. 

These officials stated that these challenges were exacerbated by the formation of 
ICE because the organizations that merged into ICE had different 
hardware/software environments (e.g., multiple e-mail systems) and different 
mission and customer needs. 
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Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 
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The stated goals of Atlas are, among other things, to: 

• enhance workforce productivity, 

• strengthen integrity, security, and privacy of information and data assets, and 

• promote information sharing and collaboration. 
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Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



Background 

Atlas Projects 
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The fiscal year 2004 expenditure plan states that Atlas consists of seven 
interrelated projects, which are briefly described below. 



Project 


Description 


Common Computing 
Environment 


•Acquire and deploy a common e-mail application (MS Exchange) to replace 
multiple and disparate e-mail applications currently in use across ICE organizations. 

•Implement hardware and software (i.e., Active Directory) that enables the common 
e-mail application to operate on multiple local area networks. 

•Install new desktop computers. 


Integration 
(Connectivity) 


•Connect new bureau organizations (e.g., Federal Protective Service, Federal Air 
Marshal Service) to ICE's communications network to, among other things, provide 
investigators and other staff quicker access to information used to accomplish 
mission duties. 

•Identify a solution for optimizing the integration and performance of these 
connections and develop a plan to implement it. 


Electronic Access 
and E-Government 


According to the program manager, Electronic Access and E-Government has 
recently been merged with the Enterprise Information project, which is described on 
the next slide. 



Source: DHS data. 
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Continued. 



Project 


Description 


Enterprise 
Information 


•Develop and prototype an approach to integrate systems and information across 
ICE, including developing a central data repository with the capabilities to access, 
navigate, and search information across multiple sources (referred to as Enterprise 
Query) and share information across existing systems on a real time basis (referred 
to as Enterprise Interoperability). 

•Establish infrastructure to support implementation of Web-based applications (i.e., 
electronic government). 


Information 
Assurance 


•Strengthen security of ICE's information, network, and systems by expanding the 
capabilities of the bureau's Security Operations Center in the following areas: audit 
log management, intrusion detection, firewall management, cryptographic services, 
computer forensics, vulnerability scanning, and penetration testing. 


Infrastructure 
Engineering 


•Provide engineering facilities (e.g., interoperability laboratory) and automated tools 
and procedures to manage and operate ICE's IT infrastructure and evaluate and 
test new technologies before deploying them in the operational environment. 



Source: DHS data. 
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Background 

Atlas Projects 



Continued. 



Project 



Description 



Transformation 
Planning 



•Implement program management structures, policies, and processes to stand up 
the program office. 

•Provide adequate program office staffing. 

•Centralize and streamline procurement planning and procedures to enable more 
efficient purchasing of hardware and software products and services. 

•Manage and oversee Atlas projects and contractors, including developing tools to 
help in these endeavors. 

•Ensure compliance with DHS's enterprise architecture. 
•Monitor adherence to cost, schedule, and performance goals. 



Source: DHS data. 
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Since fiscal year 2002, Atlas has been provided $143.17 million in appropriated 
funds. 



• $39.1 million from INS counterterrorism funding in fiscal year 2002. 8 

• $24.47 million from INS investment and operations and maintenance 
funding in fiscal year 2003. 

• $40 million from DHS appropriations in fiscal year 2004, 9 of which $30.2 
million was reprogrammed by DHS to cover other ICE priorities, leaving 
$9.8 million. 



• $39.6 million from DHS appropriations in fiscal year 2005. 10 



8 Counterterrorism funding came from the Department of Defense and Emergency Supplemental Appropriations for Recovery from and Response 
to Terrorist Attacks on the United States Act, 2002. Pub. L. No. 107-117 (Jan. 10, 2002); H.R. Report 107-350 (Dec. 19, 2001). 
9 Pub.L. No. 108-90 (Oct. 1, 2003). 
10 Pub.L. No. 108-334 (Oct. 18, 2004). 
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Background 

Atlas Expenditures 



As shown in the table below, ICE reports that it has obligated $63. 52 11 million in 
fiscal years 2002 and 2003 appropriated funds on various Atlas projects. 



Project 


Expenditures in 
fiscal year 2002 

(in millions) 


Expenditures in 
fiscal year 2003 

(in millions) 


Total 
(in millions) 


Common Computing 
Environment 


$0 


$10.51 


$10.51 


Integration (Connectivity) 


6.09 


20.41 


26.50 


Electronic Access and E- 
Government 











Enterprise Information 


1.34 


4.56 


5.90 


Information Assurance 


10.20 


9.52 


19.72 


Infrastructure Engineering 











Transformation Planning 





.89 


.89 


Total 


$17.63 


$45.89 


$63.52 



Source: DHS data. 

"According to the program manager, of the $63.57 million that Congress appropriated in fiscal years 2002 and 2003, $63.52 million was 
obligated to Atlas projects and the remainder {$.05 million) was reprogrammed to other ICE priorities. 
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Planned Use of Fiscal Year 2004 Funding 



According to the fiscal year 2004 expenditure plan, the $9.8 million will be spent on five 
projects that are immediate needs of the program. 



Project 


FY 04 Funds (in millions) 


Planned Use 


Common Computing Environment 


$3.5 


• Acquire and deploy e-mail application to ICE organizations. 

• Implement Active Directory. 

• Develop plan for acquirinq desktop computers. 


Integration (Connectivity) 


3.4 


• Connect new ICE organizations' systems to bureau's 
communications network. 

• Develop solution and implementation plan for optimizing 
performance of connections. 


Electronic Access and E- 
Government 12 





• None. 


Enterprise Information 


.75 


• Begin developing data repository and Enterprise Query 
capability. 

• Convert selected existing administrative applications (e.g., time 
and attendance) to Web-based environment. 


Information Assurance 





• None. 


Infrastructure Engineering 


.25 


• Develop laboratory to test and evaluate to-be-acquired desktop 
computers and other equipment. 


Transformation Planning 


1.92 


• Acquire program office support staff. 

• Acquire automated tool to help manage and oversee projects, 
including cost, schedule, and performance. 

• Study how to streamline procurement processes. 


Total 


$9.82 





Source: DHS data. 

52 According to the program manager, the project Electronic Access and E-Government was recently merged with Enterprise Information. 
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The Atlas expenditure plan satisfies each of the legislative conditions. 

Condition 1 Satisfied. The expenditure plan, including related program 
documentation and statements from the program manager, either satisfies or 
provides for satisfying the capital planning and investment control review 
requirements established by OMB, including Circular A-1 1 , part 3, 13 which 
establishes policy for planning, budgeting, acquisition, and management of federal 
capital assets. 

Examples of our analysis are in the following table. As the table shows, not all OMB 
requirements have been satisfied, but oral commitments have been made for doing 
so. Given that ICE has reportedly already invested $63.52 million on Atlas projects 
and plans to invest another $9.8 million this year, it is important for ICE to follow 
through on these commitments. 



"Capital investment and control requirements are now found in OMB Circular A-1 1 , part 7, rather than part 3. 
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Objective 1 Results 

Legislative Conditions 



Examples of OMB Circular A-1 1 
requirements 



Results of our findings 



Indicate whether the investment was 
approved by an investment review committee. 



The plan was approved on November 16, 2004, by the ICE IRB chair and 
on January 12, 2005, by the chief information officer, who chairs the DHS 
Enterprise Architecture Board. 



Provide justification and describe acquisition 
strategy. 



The plan and supporting documentation justify the program on the basis 
of current capability deficiencies and mission needs. However, neither 
includes an analysis of costs and benefits or return on investment. These 
documents also provide some aspects of a high-level acquisition 
strategy, such as identifying the five contracts that have been, and are to 
be used to acquire hardware and software products and program support 
services. The program manager stated that a current cost-benefit 
analysis and a more detailed acquisition strategy will be developed once 
expenditure plan funds become available. 



Summarize life cycle costs and cost-benefit 
analysis, including the return on investment. 



The program does not have a current life-cycle cost estimate nor a 
current cost-benefit analysis showing return on investment. Program 
officials stated they intend to revise and update by September 2005 
Atlas's cost-benefit and other analyses (dated 2002). However, the 
officials did not have documentation defining how this was to be 
accomplished. The program manager stated that a current cost and 
benefit analysis will be developed once expenditure plan funds become 
available." 



Provide performance goals and measures. 



The plan and supporting documentation identify one preliminary 
performance metric for each of Atlas's planned projects. According to the 
program manager, these are the program's initial performance measures 
and additional measures, linked to program goals, will be developed once 
expenditure plan funds become available. Performance goals and 
measures were not used to track the $63 million invested in Atlas during 
fiscal years 2002 and 2003.'" 



14 These areas are more fully discussed in the observation sections of the briefing. 
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Objective 1 Results 

Legislative Conditions 



Examples of OMB Circular A-1 1 
requirements 



Results of our findings 



Address security and privacy. 



The plan and supporting documentation state the importance of security 
and privacy and provide high-level information on intended security 
measures, including one proposed project — Information Assurance — that 
is intended to implement a bureauwide security program. In addition, ICE 
has a December 2003 bureau-wide security plan. However, plans for the 
Information Assurance project have not been developed, and the 
expenditure plan does not allocate any fiscal year 2004 funding to the 
project. Further, ICE's December 2003 bureauwide security plan does not 
mention Atlas or the Information Assurance project. Moreover, ICE has 
not developed an Atlas privacy impact assessment. According to the 
program manager, ICE intends to update the security plan and prepare a 
privacy impact assessment, but existing plans do not provide for how and 
when this will be accomplished. 



Provide risk inventory and assessment. 



Assessments performed on risks were via ad hoc meetings. A draft risk 
management plan was developed from these meetings and the plan 
contains an inventory of risks. It does not, however, identify, among other 
things, how the risks will be monitored. The Atlas program manager 
stated that the program office is in the process of developing more 
effective risk management and oversight processes and intends to add a 
risk analyst position when Atlas funding is received. 
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Condition 2 Satisfied. The plan, including related program documentation and 
DHS officials' statements, either satisfies or provides for satisfying the condition 
that the department ensure Atlas is compliant with DHS's enterprise architecture 
(EA). 

An EA provides a clear and comprehensive picture of an organization's 
operations and its supporting systems and infrastructure. It is an essential tool for 
effectively and efficiently engineering business processes and for implementing 
and evolving supporting systems in a manner that maximizes interoperability, 
minimizes overlap and duplication, and optimizes performance. We have worked 
with the Congress, OMB, and the federal Chief Information Officers Council to 
highlight the importance of architectures for both organizational transformation 
and IT management. An important element of EA management is ensuring that IT 
investments are compliant with EA, including basing such assessments on 
documented analysis. 

On August 6, 2004, we reported on version 1 .0 of DHS's EA, stating that DHS's 
initial EA provides a partial foundation but was missing key elements expected to 
be found in a well-defined architecture. 15 DHS has since developed version 2.0 of 
its EA. We have not reviewed this version of DHS's EA. 

15 GAO, Homeland Security: Efforts Under Way to Develop Enterprise Architecture, but Much Work Remains, GAO-04-777 (Washington, D.C.: 

August 6, 2004). 
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DHS's Enterprise Architecture Board and Enterprise Architecture Center of 
Excellence 16 are responsible for determining whether programs comply with the 
EA. On December 8, 2004, Atlas's program manager requested the center to 
assess the program's compliance with the EA. On January 10, 2005, the center 
reported the results of its assessment to the board, stating that Atlas was in 
compliance. On January 12, 2005, the board approved this compliance 
determination. 

The center based its determination on documentation submitted by the program 
manager and discussions among center staff, including officials from DHS's 
Infrastructure Transformation Office and IT Security Office. However, the 
determination was not based on documented analysis mapping Atlas's 
infrastructure architecture to the EA. Such analysis is necessary to make 
informed alignment determinations. According to the center's chair, who also 
serves as DHS's chief architect, because Atlas is in the early stages of its life- 
cycle and therefore is not very well defined, such an analysis was not required, 
and when Atlas is more defined, a thorough and documented analysis will be 
performed. 



,6 A review group made of subject manner experts that recommends EA compliance to the DHS Enterprise Architecture Board and ultimately to the 
DHS IRB. 
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Given the critical role that Atlas is to play in contributing to DHS's strategic 
information sharing and interoperability goals, it is important for ICE and DHS to 
follow through on the stated provision to base future Atlas compliance 
determinations on documented and verifiable analysis. 
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Condition 3 Satisfied. The plan, including related program documentation and 
statements from the Atlas program manager, either satisfies or provides for 
satisfying the condition to comply with the acquisition rules, requirements, 
guidelines, and systems acquisition management practices of the federal 
government. These practices provide a management framework based on the use 
of rigorous and disciplined processes for planning, managing, and controlling the 
acquisition of IT resources, including: 

• acquisition planning, which ensures, among other things, that reasonable 
plans, milestones, and schedules are developed and that all aspects of the 
acquisition effort are included in these plans; 

• solicitation, which involves making sure that a request for proposal that 
delineates a project's requirements is prepared and, consistent with 
relevant solicitation laws and regulations, that a contractor is selected that 
can most cost-effectively satisfy these requirements; 

• requirements development and management, which includes establishing 
and maintaining a common and unambiguous definition of requirements 
among the acquisition team, the system users, and the development 
contractor; 
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• project management, provides for management of the activities within the 
project office and supporting contractors to ensure a timely, efficient, and 
cost-effective acquisition; 

• contract tracking and oversight, which ensures that the development 
contractor performs according to the terms of the contract; needed contract 
changes are identified, negotiated, and incorporated into the contract; and 
contractor performance issues are identified early, when they are easier to 
address; and 

• evaluation, which determines whether the acquired products and services 
satisfy contract requirements before acceptance. 
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These acquisition management processes are also embodied in published best 
practices models, such as the Software Engineering Institute (SEI)'s Software 
Acquisition Capability Maturity Model®. 17 Examples of our analysis of ICE 
performance of these processes and practices are shown on the following table. 
They show that not all aspects of the processes and practices have been 
implemented, but that oral commitments have been made for doing so. Given that 
ICE has already invested $63.52 million on Atlas projects and plans to invest 
another $9.8 million this year, it is important for ICE to follow through on these 
commitments. 



''Developed by Carnegie Mellon Software Engineering Institute (SEI), Software Acquisition Capability Maturity Model (SA-CMM®), Version 
1.03 (March 2002). 
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Objective 1 Results 

Legislative Conditions 



Examples of practices Results of our analysis 



Acquisition planning * 

Ensures that reasonable 
planning for the acquisition 
is conducted including, 
among other things, 
developing an acquisition 
strategy and plan, 
determining the cost and 
schedule, and identifying 
risks, and defining 
requirements. 

Project management' 

Provides for the 
management of activities 
within the project office 
and supporting contractors 
to ensure a timely, 
efficient, and cost-effective 
acquisition. 



The expenditure plan and supporting documents (e.g., the fiscal year 2005 Atlas budget 
submission to OMB known as an Exhibit 300) provide aspects of a high-level acquisition 
strategy, such as identifying the five contracts that have been, and are to be used, to acquire 
products and program support services. According to the program manager, a detailed 
acquisition strategy will be developed when expenditure plan funds become available and 
current program life cycle cost and schedule estimates will be developed by September 2005. 
A draft risk management plan for the program has been developed that contains an inventory 
of risks, and according to the fiscal year 2004 expenditure plan and the Atlas program 
manager, the program will follow the bureau's 2002 System Development Life Cycle, which we 
have previously reported addresses key system acquisition planning and requirements 
definition activities. " 

ICE has begun to establish a program office with responsibility for managing the acquisition, 
deployment, operation, and sustainment of Atlas. However, current staffing consists of a 
program manager and three contractor support staff, leaving key program office positions not 
staffed (e.g., project managers, EA analyst, business analyst, risk analyst). The expenditure 
plan states that the program office will comply with the bureau's 2002 System Development 
Life Cycle, which includes activities to promote a timely, efficient, and cost-effective 
acquisition, such as implementing key acquisition management processes advocated by 
Software Engineering Institute's acquisition model, and monitoring progress through monthly 
reports on project cost, schedule, and performance. 



1B For example see, Carnegie Mellon Software Engineering Institute, Software Acquisition Capability Maturity Model (SA-CMM*), Version 1 .03 
(March 2002). 

19 For example see, GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03- 
563 (Washington, D.C.: June 9, 2003). 

20 For example see, Carnegie Mellon Software Engineering Institute, Software Acquisition Capability Maturity Model (SA-CMM®), Version 1 .03 
(March 2002). 



29 



Page 36 



GAO-05-805 Information Technology 



Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



" PAD Objective 1 Results 

^ ^-^ Legislative Conditions 



Accountability « Integrity « Reliability 



Condition 4 Satisfied. DHS and OMB satisfied the legislative condition requiring 
that the plan be reviewed and approved by the ICE IRB, DHS, and OMB. 

• The ICE IRB chair approved the fiscal year 2004 expenditure plan on 
November 16, 2004. 

• The DHS chief information officer, who also chairs the Enterprise Architecture 
Board, approved the plan on January 12, 2005. 

• OMB approved the plan on January 4, 2005. 

Condition 5 Satisfied. GAO satisfied the condition that it review the plan. 
Our review was completed on May 5, 2005. 
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Observation 1: Economic justification does not reflect recent and planned changes 
in the program's scope and purpose. 

Cost-benefit analyses are essential tools for making informed program investment 
selection and control decisions and for establishing the return on investment 
benchmark against which to measure whether investments are delivering intended 
business value. Accordingly, the Clinger-Cohen Act, OMB guidance, 21 and 
investment management best practices recognize the importance of having reliable 
and current cost-benefit analyses. 

INS developed an analysis of Atlas's costs and benefits in 2002. The analysis 
estimated that the program would cost about $800 million to implement over a 6- 
year period and would provide benefits of approximately $1 .1 billion dollars, 
primarily through better system response times and reduced operations and 
maintenance costs, as shown in the following figure. 



21 Clinger-Cohen Act of 1996, 40 U.S.C. 11101-11704; and Office of Management and Budget (OMB) Circular A-130, Management of 
Federal Information Resources (November 30, 2000). 
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Objective 2 Results 

Observations: Economic Justification 



Sources of Atlas program benefits 




3% 

Enhanced help desk operations 
5% 

Improved reliability 



Reduced operations/maintenance costs 



Better response time 



As we have previously reported, 22 it is important for cost-benefit analyses to be 
updated to reflect material changes to a program's scope, purpose, cost, 
timeframes, etc., so that agency officials will have a reliable basis for program 
investment decisions. 



22 For example, see GAO, Information Technology: Greater Use of Best Practices Can Reduce Risks in Acquiring Defense Health Care 
System, GAO-02-345 (Washington, D.C.: September 26, 2002). 
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Observation 1 : Cont. 

Since ICE became responsible for Atlas in 2003, the bureau has materially 
changed the program's scope, purpose, and priorities. Specifically, Atlas was 
expanded to 

• support additional law enforcement units (and their business requirements) 
that were merged into ICE (e.g., Federal Air Marshals Service, Federal 
Protective Service, Customs investigations, Customs intelligence); and 

• provide the flexibility to support new ICE priorities (e.g., integrating future 
anti-terrorism programs and projects, facilitating information sharing with 
domestic and international law enforcement organizations). 

In addition, the program manager said that the program is to include efforts to 
streamline and reengineer core business functions with the application of 
information technology. According to this official, details of these efforts are to be 
defined in the fiscal year 2005 Atlas expenditure plan. 



33 



Page 40 



GAO-05-805 Information Technology 



Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



~ PAD Objective 2 Results 

^ VJ xl V_/ Observations: Economic Justification 

Accountability « Integrity « Reliability 

Observation 1 : Cont. 

According to the Atlas program manager, the cost benefit analysis has not yet been 
revised to reflect changes to the program's scope and purpose because doing so 
has not been a priority. According to the fiscal year 2004 expenditure plan, revising 
the analysis is a "next step" to be taken. However, existing plans do not identify a 
date for doing so. The program manager stated that a current cost-benefit analysis 
will be developed once funds provided for in the expenditure plan become 
available. He also stated that the goal is to have a contractor complete an updated 
cost benefit analysis on or about September 30, 2005. 

Until the cost benefit analysis is revised to reflect recent and planned changes to 
the program, DHS will not have a reliable basis for making informed Atlas 
investment decisions. 
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Observation 2: Program management controls and capabilities have yet to be 
established. 

As we have previously reported, 23 the success of major modernization programs 
such as Atlas depends on having an operational program office that has, among 
other things, effectively implemented rigorous and disciplined program 
management process controls and adequately filled key human capital positions. 
Two activities key to strategically managing human capital are performing staffing 
needs assessments and defining staff roles and responsibilities. 

The SEI's Software Acquisition Capability Maturity Model (SA-CMM®) 24 has defined 
a suite of key acquisition process areas that are necessary to manage the system 
acquisition program in a rigorous and disciplined fashion. As described earlier in 
the briefing, these process areas include: 

• acquisition planning, 

• solicitation, 

• requirements development and management, 

• project management, 

• contract tracking and oversight, and 
evaluation. 



35 



23 For example, see GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563 
(Washington, D.C.: June 9, 2003). 

24 Carnegie Mellon Software Engineering Institute, Software Acquisition Capability Maturity Model (SA-CMM®), Version 1 .03 (March 2002). 
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Observation 2: Cont. 

ICE has begun to establish an Atlas program office. For example, the bureau has 
drafted a management structure and plan, which includes staff roles and 
responsibilities. However, the structure and plan are currently being reviewed by 
ICE management and the program office is not yet operational. Moreover, while 
key acquisition management processes have been defined in the System 
Development Life Cycle methodology, which our previous work 25 has shown 
adequately defines the critical management processes needed to successfully 
acquire systems, the program office has yet to implement these processes. 



25 For example, see GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563 
(Washington, D.C.: June 9, 2003). 
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Observation 2: Cont. 



In addition, the program office is not adequately staffed. 26 Currently, the office has 
staffed the program manager position and it has three contracting staff performing 
such functions as developing staffing needs assessments and other program 
management related activities. Further, while the program manager recently 
assessed staffing needs for program support positions (e.g., financial management, 
contracting, EA), he has not yet determined the staffing needs for five Atlas 
projects. Specifically, the program manager recently asked, and the project 
managers provided estimates of, staffing needed, but these estimates were not 
based on an estimating methodology or staffing needs assessment. Instead, the 
project managers provided estimates of the staff that could be obtained given the 
funding provided in the plan. Moreover, of the seven program support positions that 
the program has determined it needs, none have been filled. (The figure on the 
next slide shows the proposed office structure, along with the organizational areas 
where staffing needs have and have not been assessed, and where staffing needs 
have and have not been filled.) 

26 According to the program manager, Atlas staff were transferred to the US-Visitor and Immigrant Status Indicator Technology program in 2003, 
which is managed by the DHS Under Secretary for Border and Transportation Security. 
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Objective 2 Results 

Observations: Program Management Controls and Capabilities 



Observation 2: Cont. Proposed Program Management Office 
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3CFTE 



Risk 
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3 CFTE 



Documentation 
Specialist 
3 CFTE 



Common 
Computing 



Enterprise 
Information 



Integration 



Information 

Assurance 



Infrastructure 
Engineering 



Staffing in place 
Staffing need assessed 



-''| Staffing need not assessed 

Source: GAO analysis of DHS data. 



27 Government full-time employees 
2a Contracting full-time employees 

29 According to the program manager, the staff for the Transformation Planning project also serve as the staff for the program office. 
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Observation 2: Cont. 



The program manager attributes the state of the program office, including controls 
and capabilities, to competing DHS priorities. He stated that ICE plans to 
strengthen program management controls and capabilities once funds provided for 
in the expenditure plan are available. In particular, he cited two projects 
(Transformation Planning and Infrastructure Engineering) in the expenditure plan 
that have this goal. However, existing program documentation does not describe 
how and when these projects are to achieve this goal. Moreover, it should be noted 
that of the $63.52 million obligated for Atlas in fiscal years 2002 and 2003, 
$900,000 (or about 1 .4 percent of the total) was obligated for these two projects. 
While the current expenditure plan proposes investing $2.17 of the $9.8 million on 
these two projects, this still represents but 4 percent of the $73.37 million Atlas 
funding to date going to improving program management. By contrast, our work on 
other IT modernization programs, such as US-VISIT, shows that roughly 19 percent 
was invested in program management. 



39 



Page 46 



GAO-05-805 Information Technology 



Appendix I 

Briefing to the Staffs of the Subcommittees 
on Homeland Security, Senate and House 
Committees on Appropriations 



" PAD Objective 2 Results 

*""* K ~ 1 Observations: Program Management Controls and Capabilities 



Accountability « Integrity * Reliability 



Observation 2: Cont. 



Until the above program management controls and capabilities are in place and 
functioning, ICE faces the increased likelihood that Atlas will not meet its objectives 
on schedule and within budget. 
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Objective 2 Results 

Observations: Performance Goals and Measures 



Observation 3: Program goals, expected benefits, and reported achievements are 
not fully aligned. 

The Clinger-Cohen Act 30 requires the use of effective IT management practices, 
including measuring the contributions of IT investments to achieving agency 
mission outcomes. To this end, OMB states 31 that agencies should, among other 
things 

• establish program performance goals and expected benefits, 

• develop outcome-based measures to assess actual program performance (i.e., 
achievements) against expected benefits, and 

• ensure that goals, expected benefits, and achievements are properly aligned. 



30 Clinger-Cohen Act of 1996, Public Law 104-106; and Office of Management and Budget (OMB) 
Circular A-130, Management of Federal Information Resources (November 30, 2000). 
31 OMB Circular No. A-1 1 , Part 7 (revised July 2004). 
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Observation 3: Cont. 

The Atlas expenditure plan and documentation show that the program has defined 
goals and expected benefits and has reported actual achievements accomplished 
during 2002 and 2003. The stated goals include: 

• enhancing productivity, and 

• assuring integrity, security, and privacy of information and data assets, and 

• promoting information sharing and collaboration. 



The stated benefits include: 

• better response time, 

• reduced operations/maintenance costs, 

• improved reliability, and 

• enhanced help desk operations. 
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Observation 3: Cont. 

In addition, examples of stated achievements are 

• purchased Active Directory hardware and software for the e-mail system, 

• initiated an interim Security Operations Center, and 

• developed a data encryption approach for the network. 

However, the relationships among goals, benefits, and achievements have not 
been defined, and are not otherwise apparent in all cases. For example, it is not 
clear how the following reported achievements relate to Atlas goals. 

• improving the capacity of the network, 

• implementing tools to monitor network performance, and 

• completing an Enterprise Information Concept of Operations document. 

Moreover, the reported achievements are not expressed in terms of measurable 
outcomes or results, but rather as activities completed. 
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Observation 3: Cont. 

The program manager stated that the 2002 and 2003 achievements were not 
analyzed and aligned to program goals and benefits and outcome-based measures 
were not developed because the emphasis at the time was on buying and 
deploying long-overdue infrastructure upgrades as quickly as possible. However, 
he also stated that the program intends to define, ensure, and disclose the linkage 
among program goals, benefits, and results in the future. To this end, the program 
manager stated that one performance measure for each project has been defined 
as a starting point and that other outcome-based performance measures will be 
defined and used to assess program progress. However, existing program plans 
and documentation do not specify how and when this will be done. 

The program manager also told us that the state of Atlas's performance practices 
are due to competing DHS priorities limiting the resources that have been devoted 
to the program. Until the program aligns its goals, benefits, and performance 
measures, it will not have the necessary means for measuring progress, ensuring 
accountability, and making well-informed investment decisions. 
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Observation 4: Fiscal year 2004 expenditure plan does not provide sufficient 
information on program commitments to permit effective congressional oversight. 

As we have previously reported, 32 the legislative requirement to submit expenditure 
plans for major IT modernization programs, like Atlas, to the Appropriations 
Committees is intended to provide lawmakers with a sufficient understanding of the 
programs to permit informed decision-making about the use of the appropriated 
funds and provide a mechanism for holding the agency accountable for results. Our 
prior experience in working with Congress and other agencies on developing and 
implementing expenditure plans shows that these plans need to disclose a 
sufficient level and scope of information for Congress to understand what the 
system capabilities and benefits are to be delivered, by when, at what cost, and 
what progress is being made against the commitments. 

The Atlas expenditure plan does not show the level of detail and scope of the 
program for Congress to understand its plans and commitments relative to system 
capabilities, cost, benefits, and schedule. Further, it does not sufficiently describe 
progress made against program commitments (e.g., expected benefits). 

32 For example, see GAO, Information Technology: Homeland Security Needs to Improve Entry Exit System Expenditure Planning, GAO-03-563 
(Washington, D.C.: June 9, 2003). 
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Observation 4: Cont. 

Instead, the expenditure plan and supporting documentation describe, for example, 
high-level system capabilities to be delivered under each project, planned 
expenditure aggregated by project (not linked to system capabilities). It does not 
link planned expenditures to system capabilities, set milestones for delivery of 
system capabilities, or discuss benefits to be realized as a result of planned system 
investments. 

According to the Atlas program manager, the state of the plan reflects the 
program's uncertainty about the appropriate level of detail in expenditure plans. 
This official also stated that future plans will reflect GAO's published work on the 
content of program expenditure plans. If it does not, the Congress will not have 
essential information needed to make informed decisions about expenditure plan 
approval and to oversee progress. 
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The fiscal year 2004 Atlas expenditure plan, in combination with related program 
documentation and program officials' statements, satisfies the legislative conditions 
set forth by Congress. However, this satisfaction is based on plans and 
commitments that provide for meeting these conditions, rather than on completed 
actions to satisfy the conditions. As such, much remains to be accomplished before 
Atlas planning and management efforts can be considered effective and thereby 
minimize the risks associated with the program's capacity to deliver promised IT 
infrastructure capabilities and benefits on time and within budget. 

The current state of planning and management puts the program at risk. While this 
is partially due to events beyond the program's control, such as the department's 
decision to reprogram Atlas funding and to redeploy Atlas staff to competing DHS 
priorities, as well as changes to the program's scope and purpose when it 
transitioned from INS to ICE, it is also due to the program's decision to not use 
fiscal year 2002 and 2003 funds to invest in program management capabilities. 
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Given that more than $60 million has been reportedly obligated to date on the 
program, resources have been available to strengthen planning and management 
capabilities in key areas, but investment in these areas has been deferred. Deferral 
of establishing such program planning and management controls and capabilities, 
such as having reliable and current economic justification for the program, a 
capable program office, and clearly aligned program goals, benefits, and 
performance measures, introduce unnecessary risk to the program. 

Moreover, not providing congressional decision-makers with the information that 
they need about program commitments to be met with the expenditure plan funds, 
including the benefits to be produced, the capabilities to be delivered, and the cost 
and schedule estimates to be met, impedes congressional oversight. 
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To minimize risks to the Atlas program, we recommend that the Secretary of 
Homeland Security, through the Under Secretary for Border and Transportation 
Security, direct the Assistant Secretary for Immigration and Customs Enforcement 
to ensure that ICE follows through on commitments to implement effective 
management controls and capabilities by 

• Revising and updating the cost-benefit analysis to identify current mission 
requirements, how they will be met, and an estimate of the program's 
incremental and life-cycle costs, benefit, schedule, and return on investment. 
This should also include establishing plans, associated tasks, and milestones 
for accomplishing this effort. 

• Making the Atlas program office operational by (1) developing a staffing needs 
assessment to determine the positions and the level of staffing needed for all 
projects to adequately manage the program, including a human capital 
strategy for acquiring the staff and a timetable for bringing them on board; (2) 
finalizing the roles and responsibilities for the positions identified in the staffing 
assessment and for the projects; and (3) implementing and institutionalizing 
key acquisition management controls, including risk management processes 
where relevant responsibilities are assigned and key risks and their status are 
reported to an executive body. 
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Recommendations for Executive Action 



Developing and implementing an updated Atlas security plan and privacy 
impact assessment. This should also include establishing plans, associated 
tasks, and milestones for accomplishing this effort. 

Developing and implementing rigorous performance management practices for 
the Atlas program that include properly aligned goals, benefits, and 
achievements, and anticipated achievements that are defined in measurable 
terms. This should also include establishing plans, associated tasks, and 
milestones for accomplishing this effort. 

Ensuring that future expenditure plans fully disclose the system capabilities, 
schedule, cost-benefits to be delivered, as well as the acquisition strategy for 
Atlas. 
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In providing oral comments on a draft of this briefing, ICE's chief information officer 
and the Atlas program manager agreed with our findings and conclusions and 
stated that our recommendations were reasonable. They also provided technical 
comments, which we incorporated in the briefing as appropriate. 
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Scope and Methodology 

To accomplish our objectives, we 

• analyzed the fiscal year 2004 Atlas expenditure plan and supporting documents against 
legislative conditions and other relevant federal requirements, guidance, and best 
practices to determine whether the conditions were met, and in doing so, considered the 
conditions met when the expenditure plan, including supporting program documentation 
and program officials' representations, either satisfied or provided for satisfying the 
conditions, and 

• assessed supporting documentation and interviewed program and other involved ICE 
and DHS officials to determine capabilities in key program management areas, such as 

• acquisition planning, 

• enterprise architecture, 

• project management, 

• human capital planning, and 

• risk management. 

For DHS data that we did not substantiate, we have made appropriate attribution indicating 
that data's source. 

We conducted our work at ICE and DHS headquarters in Washington, D.C. from March 2005 
through May 2005 in accordance with generally accepted government auditing standards. 
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U.S. Department of Homeland Security 

Washington, DC 20528 




Homeland 
Security 



August 18, 2005 

Mr. Randolph C. Hite 

Director, Information Technology Architecture and System Issues 
U.S. Government Accountability Office 
Washington, DC 20548 

The Department of Homeland Security (DHS) appreciates the opportunity to review and 
comment on the Government Accountability Office's (GAO) draft report GAO-05-805 entitled, 
"INFORMATION TECHNOLOGY: Management Improvements Needed in Immigration and 
Customs Enforcement's Infrastructure Modernization Program". The Department concurs with 
all recommendations for executive action contained in the report. 

To minimize risks to the Atlas program, GAO made the following recommendations to ensure 
Immigration and Customs Enforcement (ICE) follows through on commitments to implement 
effective management controls and capabilities. 

It should also be noted that with the recent release of expenditure authority for the ATLAS FY04 
funds, ICE is now better positioned to aggressively address the concerns identified in the GAO 
Draft Report. Some of the immediate steps already taken are described below. 

GAO Recommendation 1: Revising and updating the cost-benefit analysis, to identify current 
mission requirements, how they will be met, and an estimate of the program's incremental and 
life cycle costs, benefit, schedule and return on investment. This should also include establishing 
plans, associated tasks and milestones for accomplishing this effort. 

Response: An Atlas Preliminary Business Case was completed on June 21, 2005. It reflects a 
high-level statement of the planned functionality and environment established by Atlas. The 
Atlas Comprehensive Business Case is being developed and is scheduled for completion by 
September 30, 2005. The Atlas Comprehensive Business Case will include a detailed cost benefit 
analysis, operations and maintenance costs for all six Atlas projects. 

GAO Recommendation 2: Making the Atlas Program office operational by (1) developing a 
staffing needs assessment to determine the positions and the level of staffing needed for all 
projects to adequately manage the program, including a human capital strategy for acquiring the 
staff and a timetable for bringing them on board; (2) finalizing the roles and responsibilities for 
the positions identified in the staffing assessment and for the projects; and (3) implementing and 
institutionalizing key acquisition management controls, including risk management processes 
where relevant responsibilities are assigned and key risks and their status are reported to an 
executive body. 
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Response: The Atlas Program Management Office (PMO) has been established and full project 
staffing for the Atlas PMO has been initiated. A draft organizational assessment for the Atlas 
PMO is complete and undergoing review by ICE management. The draft organizational 
assessment includes a detailed description of functional roles and responsibilities for each Atlas 
PMO position. A comprehensive Atlas staffing plan will be completed by September 30, 2005. 
Full project staffing for the Atlas PMO will begin immediately. 

Atlas acquisition strategies are reflected in the FY 2005 Atlas Expenditure Plan, currently 
undergoing formal DHS management review. The required Atlas Program Management Plan, 
Atlas Risk Management Plan, Atlas Acquisition Plan, and Atlas Acquisition Program Baseline 
are scheduled for completion by October 31, 2005. 

GAO Recommendation 3: Developing and implementing an updated atlas security plan and 
privacy impact assessment. This should also include establishing plans, associated tasks and 
milestones for accomplishing this effort. 

Response: A Systems Security Plan, and Systems Security Test Plan, are being developed and 
will be completed by December 3 1 , 2005. The Atlas Privacy Impact Assessment was submitted 
to the DHS Privacy Office on August 2, 2005 for review. 

GAO Recommendation 4: Developing and implementing rigorous performance management 
practices for the Atlas program that include properly aligned goals, benefits and achievements, 
and anticipated achievements that are defined in measurable terms. This should also include 
establishing plans, associated tasks and milestones for accomplishing this effort. 

Response: The FY 2005 Atlas Expenditure Plan includes a section containing outcome 
measures and an appendix containing proposed Atlas performance measures. ICE submitted the 
proposed Atlas performance measures to the Office of Management and Budget (OMB) on July 
13, 2005, with its PART review. 

The Atlas PMO is in the process of developing policies and procedures to track these 
performance measures, and acquiring project management tools to be used to support tracking 
program/project costs, schedules, and performance. 

GAO Recommendation 5: Ensuring that future expenditure plans fully disclose the system 
capabilities, schedule, cost and benefits to be delivered, as well as the acquisition strategy for 
Atlas. 



Response: The FY 2005 Atlas Expenditure Plan, currently being reviewed by DHS 
management, is a 74-page document consisting of an Executive Summary, six sections and six 
appendices, and addresses planned outcomes for each project, including system capabilities, 
project schedule, costs, planned budget obligations and Atlas program benefits. The FY 2005 
Atlas Expenditure Plan also outlines acquisition strategies. Future Atlas Expenditure Plans will 
be further improved based upon lessons learned. 



Page 61 



GAO-05-805 Information Technology 



Appendix II 

Comments from the U.S. Department of 
Homeland Security 



We thank you for the opportunity to provide comments on this draft report and look forward to 
working with you on future homeland security issues. 



Sincerely, 




Director, Departmental GAO/OIG Liaison 
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investigative arm of Congress, exists to support Congress in meeting its 
constitutional responsibilities and to help improve the performance and 
accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
and provides analyses, recommendations, and other assistance to help 
Congress make informed oversight, policy, and funding decisions. GAO's 
commitment to good government is reflected in its core values of 
accountability, integrity, and reliability. 
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